Tchater maintenant avec le support
Tchattez avec un ingénieur du support

syslog-ng Premium Edition 7.0.18 - Release Notes

New features in syslog-ng PE 7.0.12

Send log messages directly to Splunk HEC

Version 7.0.12 of syslog-ng PE can directly post log messages to a Splunk deployment using the HTTP Event Collector (HEC) over the HTTP and Secure HTTP (HTTPS) protocols. The solution is optimized for performance, and supports sending messages in batch mode, multithreaded message sending, and load-balancing to multiple Splunk indexer nodes.

HTTPS connection, as well as password- and certificate-based authentication is supported. The content of the events is sent in JSON format.

For details, see "splunk-hec: Sending messages to Splunk HTTP Event Collector" in the Administration Guide.

Ubuntu 18.04 (Bionic Beaver) support

Version 7.0.12 of syslog-ng PE is now available on the Ubuntu 18.04 platform. Note that the Java-based drivers of syslog-ng PE (used for Apache Kafka, Elasticsearch, HDFS) require Java 8, Java 10 is not supported.

http() destination improvements

The http() destination now supports load balancing, so a single syslog-ng PE instance can feed log data to multiple HTTP servers, for example, multiple ingestion nodes of an Elasticsearch cluster. For details, see "Batch mode and load balancing" in the Administration Guide.

HTTP and HTTPS redirections now also handled automatically.

Enhancements
  • The syslog() and network() drivers now support the so-reuseport() option that allows multiple sockets on the same host to bind to the same port, improving the performance of multithreaded network server applications running on top of multicore systems.

  • The Cisco parser now supports Cisco Catalyst formatted triplets.

New features in syslog-ng PE 7.0.11

Write your own destination in Python

Extending syslog-ng PE in Python has been supported for several releases, but so far this feature was mostly undocumented. Now you can find more details about this feature in "python: writing custom Python destinations" in the Administration Guide.

Write your own message source in Python

Starting with syslog-ng PE version 7.0.11, you can write custom message sources in Python. Both server-style and fetcher-style sources are supported. For more details, see "python: writing server-style Python sources" in the Administration Guide and "python-fetcher: writing fetcher-style Python sources" in the Administration Guide.

Reset the license counter

You can now configure syslog-ng PE to reset the counter that stores the list of known hosts. That way, you can make syslog-ng PE forget old clients that do not exist anymore, and otherwise would be counted against the license limit. This is especially useful in large datacenters or cloud environments where the client hosts are deployed and removed frequently.

For details, see the "Global options" in the Administration Guide.

Enhancements
  • When hdfs-append-enabled is set to true, syslog-ng PE will append new data to the end of an already existing HDFS file. Note that in this case, archiving is automatically disabled, and syslog-ng PE will ignore the hdfs-archive-dir option.

  • New template functions are available: url-decode(), url-encode() and base64-encode(). For details, see "Template functions of syslog-ng PE" in the Administration Guide.

  • The syslog-ng-ctl config command can display the contents of the configuration file that syslog-ng PE is currently running.

Deprecated features

The elasticsearch() destination has been deprecated, because it supports only ElasticSearch version 1.x, which has been End-of-Life since January, 2017. Use the elasticsearch2() destination instead.

New features in syslog-ng PE 7.0.10

Send logs using the Advanced Log Transport Protocol (ALTP)

Using the new Advanced Log Transfer Protocol (ALTP), you can send (and receive) log messages in a reliable way over the TCP transport layer. ALTP is a proprietary transport protocol that prevents message loss during connection breaks. The transport is used between syslog-ng PE hosts (for example, a client and a server, or a client-relay-server), and interoperates with the flow-control and reliable disk-buffer mechanisms of syslog-ng PE, thus providing the best way to prevent message loss.

ALTP is the successor of the Reliable Log Transport Protocol (RLTP) introduced in version 6 LTS. Starting with version 7.0.9, the syslog-ng PE application can receive messages sent using RLTP from hosts that are running version 6 of syslog-ng PE or the syslog-ng Agent for Windows application. Starting with version 7.0.10, syslog-ng PE can now also send messages using ALTP to hosts that are running version 6 or at least version 7.0.9 of syslog-ng PE or the syslog-ng Agent for Windows application. For details, see "Advanced Log Transfer Protocol " in the Administration Guide.

An additional change regarding the Advanced Log Transfer Protocol is that the global flush-lines() option does not affect the batch size of ALTP anymore. Instead, a new ALTP has been introduced, called batch-size(). For details, see "ALTP options" in the Administration Guide.

Enhancements

Highlights of 7.0.9

Receive logs using the Advanced Log Transport Protocol (ALTP)

With the new Advanced Log Transport Protocol (ALTP) you can receive log messages in a reliable way over the TCP transport layer. ALTP is a proprietary transport protocol that prevents message loss during connection breaks. The transport is used between syslog-ng PE hosts (for example, a client and a server, or a client-relay-server), and interoperates with the flow-control and reliable disk-buffer mechanisms of syslog-ng PE, thus providing the best way to prevent message loss.

ALTP is the successor of the Reliable Log Transport Protocol (RLTP) introduced in version 6 LTS. Starting with version 7.0.9, the syslog-ng PE application can receive messages sent using RLTP from hosts that are running version 6 of syslog-ng PE or the syslog-ng Agent for Windows application. For details, see "Advanced Log Transfer Protocol " in the Administration Guide.

Easily receive and parse messages from remote hosts

The default-network-drivers() source is a special source that uses multiple source drivers to receive and parse several different types of syslog messages from the network. For details, see "default-network-drivers: Receive and parse common syslog messages" in the Administration Guide.

Transfer log messages and their key-value pairs between syslog-ng nodes

The Enterprise-wide message model or EWMM allows you to deliver structured messages from the initial receiving syslog-ng component right up to the central log server, through any number of hops. It does not matter if you parse the messages on the client, on a relay, or on the central server, their structured results will be available where you store the messages. Optionally, you can also forward the original raw message as the first syslog-ng component in your infrastructure has received it, which is important if you want to forward a message for example, to a SIEM system. To make use of the enterprise-wide message model, you have to use the syslog-ng() destination on the sender side, and the default-network-drivers() source on the receiver side.

Clearer configuration using if, else, elif conditions

You can use if {}, elif {}, and else {} blocks to configure conditional expressions. For details, see "if-else-elif: Conditional expressions" in the Administration Guide.

Message parsing

syslog-ng PE version 7.0.9 includes parsers for the sudo and iptables applications.

Compliance and integration

You can now store and forward the incoming messages exactly as received using the store-raw-message source flag and the RAWMSG macro. These are especially useful if you are forwarding the messages to a SIEM, or if you have to preserve the original message for legal reasons. For details, see "Macros of syslog-ng PE" in the Administration Guide.

Enhancements
Documents connexes